Unexplained, Constant Disk Activity

[User]

My machine at work runs Windows 2000. A few weeks ago we had the
zotob virus come through. The computer people came through and ran
virus checkers and installed Service Pack 4.

Ever since, my my disk is constantly doing something. Task manager
shows it's a process called SERVICES.EXE. A little sleuthing shows
that C:\WINNT\Security\temp.edb is the file involved. By holding down
the F5 key in that directory I can see that this file appears, gets
written with about 1 Mb, goes to zero length, back to about 1 Mb, back
to zero length, back to about 1 Mb, then is erased entirely. This
cycle repeats itself about every four seconds. Day in, day out.
Whether I'm running anything or not. Whether I'm logged in or not.
And it does slow down my disk access in other processes. And I'm sure
it's going to cause the disk to fail earlier than it should.

Our computer people are stumped. Their standard list of actions on a
problem goes like this:

1) "Log out and log back in."

"Didn't work?"

2) "Try rebooting."

"Still didn't work?"

3) "We're going to have to re-image your machine."

There's never anything tried between rebooting and re-imaging.

Does anybody have any ideas? I've had other problems which were
probably minor, but resulted in re-imaging. And each time they
re-image my machine I have to spend hours rebuilding all my shortcuts,
favorites, custom settings, etc.

Any ideas? What might be causing SERVICES.EXE to constantly write &
erase C:\WINNT\Security\temp.edb?

Thanks for any help!

 

[laurent.vanroy]

Have you checked all the services started on your PC, have you checked
all the processus running on your PC ? Make a quick search on the net
for each unknown service/process to have an idea of its purpose. May be
you still have an unwanted service.

Hope this helps.

Laurent

 

[Bob I]

One possibility.
http://www.awprofessional.com/articles/article.asp?p=101405&seqNum=10&rl=1

 

[User]

Have you checked all the services started on your PC, have you checked
all the processus running on your PC ? Make a quick search on the net
for each unknown service/process to have an idea of its purpose. May be
you still have an unwanted service.

The process SERVICES.EXE is the one responsible for all the disk
activity. I have no clue beyond that.

Since it was C:\WINNT\security\temp.edb that was the subject of all
the disk activity, I made that file read-only.

This significantly reduced disk activity. But then
C:\WINNT\spupdw2k.log started getting appended with the line

"SceOpenProfile failed - SceStatus = 0x9. Retry number: 001"

with the number at the end incrementing.

So, I made C:\WINNT\spupdw2k.log read-only as well.

I feared I might have have effectively locked myself out of the
system, so I rebooted, expecting I might have to go in through the
recovery console and remove the read-onlys from those files. But I
rebooted and logged back in just fine. I know I haven't fixed the
problem, but at least that infernal disk rattling has stopped.

Any clues what the root cause might be?

Thanks.